Linux - out-of-memory (L-OOM)

Linux - out-of-memory (L-OOM)

Whilst researching on mobile phones using Linux OS I came across a report on guidelines for creating robust embedded systems (published in 2009). The report's discussion arrived at the topic out-of-memory (OOM) and perceived flaws with Linux overbooking the kernel. The report calls this 'OOM Killer'


The report noted:

"One Linux detractor says this about the feature:

"Linux on the other hand is seriously broken. It will by default answer "yes" to most requests for memory, in the hope that programs ask for more than they actually need. If the hope is fulfilled Linux can run more programs in the same memory, or can run a program that requires more virtual memory than is available. And if not then very bad things happen."


The report then goes on to record this gem of an analogy as to what might happen when Linux over commits.


"One comedian has described this feature of Linux as follows:

"An aircraft company discovered that it was cheaper to fly its planes with less fuel on board. The planes would be lighter and use less fuel and money was saved. On rare occasions however the amount of fuel was insufficient, and the plane would crash. This problem was solved by the engineers of the company by the development of a special OOF (out-of-fuel) mechanism. In emergency cases a passenger was selected and thrown out of the plane. (When necessary, the procedure was repeated.) A large body of theory was developed and many publications were devoted to the problem of properly selecting the victim to be ejected. Should the victim be chosen at random? Or should one choose the heaviest person? Or the oldest? Should passengers pay in order not to be ejected, so that the victim would be the poorest on board? And if for example the heaviest person was chosen, should there be a special exception in case that was the pilot? Should first class passengers be exempted? Now that the OOF mechanism existed, it would be activated every now and then, and eject passengers even when there was no fuel shortage. The engineers are still studying precisely how this malfunction is caused."

Seminar on GSM Standards

Seminar on GSM Standards

.
It is clear that associated with mobile phone examination to obtain evidence that examiners must read the GSM Standards to understand the data evidence and whether the devices used acquire the data. The concern amongst examiners still exists because there are so many Standards current and historical and each providing variations on obtaining evidence and interpretation that it is a daunting task to know where to start. Would it be worth having a one-day seminar in the UK to go through the GSM Standards. Standards can change 2-3 times a year and presenting the information at a seminar would assist in getting across important facts and guide through how to get to the appropriate information in them. I wont be charging for my time to prepare the presentation and present the findings.
.
So that delegates can attend free of charge I am also looking for:
.
1) Sponsor (to pay) for the Seminar room/hall
2) A location must be near to a central train station (not requiring loads of train changes)
3) Sponsor (to pay) for the teas/coffee and sandwiches etc
4) Exhibitors at the Seminar
.
Can you send some feedback whether you are interested in attending or sponsoring.

UPDATE: Seminar on GSM Standards

Objectives

Upon completion of the seminar, the participant should:


• Understand the GSM Standards development and legal references

• Be aware of GSM system standards relevant to the examination or investigation

• Have an awareness of GSM interfaces to comprehend symbiotic relationships for call/data tracing

• To know where to look to attribute identity conventions

• Know availability of standards

There are five presentation modules:

1) Introduction

2) GSM System Standards

3) GSM Specified Interfaces (10 + 1)

4) Identifier Conventions

5) Access to Standards

Mobile Phone outsourcing goes insourcing

Mobile Phone outsourcing goes insourcing

KENT NEWS: Sim card specialists will aid the technological tussle with crime following the formation of a new mobile phone unit at Kent Police.

.
Officers throughout the county can now access deleted text messages, photographs and more in-house, saving the force an estimated £1.5 million that would have been spent on payments to private companies over the next two years.
.
The unit was launched late last year and forms part of the existing digital forensics division, which is responsible for the examination of all computers, hard disk drives and digital storage devices.
.
[Texted from article snipped]
.
Last month Kent Police Authority – which oversees the running of Kent Police – revealed it will lose £20m in Government funding over the next few years and will be looking to make savings wherever possible.
.
However, it also awarded the force a budget for 2010-11 of £285m – an increase of £8m from the previous financial year.
.
http://www.yourthanet.co.uk/kent-news/Police-launch-new-high__tech-mobile-phone-unit-newsinkent33762.aspx?news=local&goback=.myg

Google says PC will be irrelevant in 3 years

Google says PC will be irrelevant in 3 years

Interesting article in The Register:



http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/



I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.

Google says PC will be irrelevant in 3 years

Google says PC will be irrelevant in 3 years

Interesting article in The Register:



http://www.theregister.co.uk/2010/03/05/google_says_pc_will_be_irrelevant_in_three_years/



I can see where Google is coming from because I have similar thoughts about how mobile phones and SIM/USIM cards, as devices, are making significant inroads to provide functions and features traditionally provided by computers. This is another area that is forcing change on the work we do and why I believe we cannot afford to rest on any laurels we think we may have in our field of distinction and move as quickly as is reasonably practicable to do so to generate Certified/Validated tools.

Mobile Phone is not a 'Closed Container' Part 2

Mobile Phone is not a 'Closed Container' Part 2

I mentioned in the thread " Mobile Phone is not a 'Closed Container' " that there was more to this disucssion:

http://trewmte.blogspot.com/2010/02/mobile-phone-is-not-closed-container.html

When any digital exhibit produces evidence it is normally presented in a computer document format. The Courts looks at the defendant's behaviour in relation to the data shown in the record.

The categories said to underpin S129 Criminal Justuce Act 2003 are set out in Archibold 2010:

Computers

i) The first is where the computer has been used simply as a calculator to process information.

ii) The second category is information which the computer has been programmed to record.

iii) The third category is information recorded and processed by the computer which has been entered by a person, whether directly or indirectly. It is only information from a computer in this third category which is hearsay.

It is Category II (Cat 2) which it is being said that a mobile phone is a dumb terminal which when plugged in is instructed simply to print out, yet examination of the case law used to reference Cat2 does not support the actions of what happens when examinations are conducted on mobile phones.

Category III (Cat 3) is relevant as it covers the multitude of actions that occur from the time the mobile phone is first seized to the time, in the chain of custody, the mobile phone examiner completes his/her examination. Funnily enough it is the mobile phone examiner who is unfairly prejudiced here because it most cases any actions conducted on the mobile phone prior to reaching the moible phone examiner sets him/her up for a dished up fait accompli. That is because phones do not have a specific application creates an audit trail to record all activity of when, for instance, deletion takes place or the person causing that to happen.

Other instances:

- At the point of seizure - entering *#06# (technically that is asterisk* octothorp# 0 6 octothorp#). Then mistakenly pressing the go key with added or deleted entries to the phone memory call history.

- Using faraday bags for sitched on at seizure where the world and his wife can punch away on the keypad of the handset with no traceability and auditability of what has gone on. The exmainer simply cannot be sure where the data comes from.

- the pressing of speed dial keys the place entries in call history.

- opening unread text messages.

With the above examples in mind, what does the Statute set out:

129. Representations other than by a person

(1) Where a representation of any fact -

(a) is made otherwise than by a person, but

(b) depends for its accuracy on information supplied (directly or indirectly) by a person,

the representation is not admissible in criminal proceedings as evidence of the fact unless it is proved that the information was accurate.

(2) Subsection (1) does not affect the operation of the presumption that a mechanical device has been properly set or calibrated.

Mobile telephones are not simple mechnical devices and are not calibrated, after leaving the factory originating their maunfacture, and are not calibrated prior to securing data from them for evidence. When some much goes unchecked with the evidence and the chain of custody can prove quite difficult to establish, how can behaviour in relation to the data be established with proper and appropriate procedual paths in place? The current system is unnecessarily and unwarrantedly crude in its operation demonstrates the lack of necessary skillsets.

I should imagine those in quality assurance (QA) promoting the merits of ISO9000, ISO17020 and ISO17020 are hampered to a greater degree (and most likely apoplectic at this stage) finding out where the difficulties exist. Whilst these standards are excellent (and I do have respect for them) for identifying each stage-point that needs to be reached so that assessment can be conducted to confirm conformity, they have no application to generating the criteria to build each stage-point given the issues associated with Cat 3 S129 CJA2003, above.

There is a way forward though.

Mobile Phone is not a 'Closed Container'

Mobile Phone is not a 'Closed Container'

.

There has recently been an important judgment in an Ohio Supreme Court that ruled a mobile phone is not covered by the status that a mobile phone is a "closed container" for the purposes of searches; thus mobile phones require a "warrant" prior to searching their (mobile phones') contents. The ruling also refers to the "unique nature of cell phones".
.
.

A commentary discussing part of the Ohio Supreme Court finding
.
In the present case, Justice Lanzinger wrote, "The state argues that we should follow Finley and affirm the court of appeals because the trial court was correct in its conclusion that a cell phone is akin to a closed container and is thus subject to search upon a lawful arrest. We do not agree with this comparison, which ignores the unique nature of cell phones. Objects falling under the banner of 'closed container' have traditionally been physical objects capable of holding other physical objects. Indeed, the United States Supreme Court has stated that in this situation, 'container' means 'any object capable of holding another object.' New York v. Belton,/em> (1981)."
.
.

Further more indepth information:
.

http://www.supremecourt.ohio.gov/rod/docs/pdf/0/2009/2009-Ohio-6426.pdf
http://www.supremecourt.ohio.gov/PIO/summaries/2009/1215/081781.asp
.
.

This is not the first time the treatment towards mobile telephones has come under scrutiny in the US:
http://trewmte.blogspot.com/2009/02/cellular-phones-warrantless-searches.html
.
.

Looking Forward
It is going to be interesting to see how the US Supreme Courts will interpret how mobile phones have been examined and the programming that is imposed on them before the evidence was gathered?
.
.

In the UK, mobile phones have, for some unearthly reason, been attributed a Catagory 2 status under S129 Criminal Justice Act 2003. This allows the Prosecution to stand before the Court and say there is no justifiable reason to have this (mobile telephone) evidence excluded or make it the subject of a voire dire. Apparently, the Prosecution having been mistakenly led to suggest to the public Courts of Law that a mobile phone is almost a dumb terminal to which one simply plugs it in and simply print-off the evidence.
.
.

Having spoken to as many examiners, in the independent marketplace and in the Police as I can and running discussions at Forums (frequented by examiners), I cannot find one examiner who admits to ever informing (or who would have informed) the Prosecution of the explanation given above that would put mobile phones under Cat 2 S129 CJA2003.
.
.

I have not found one examiner who doesn't admit that for the majority of mobile phones it is inescapable thus unavoidable but to programme the mobile phone to get the evidence. Moreover, it has not been possible as yet to find out where the advice came from that informed the Prosecution to make the Cat 2 S129 CJA2003 attribution, when clearly Cat 3 for S129 CJA2003 is the appropriate.
.
.

What examiners are saying is that they do record 'contemporaneous notes' and honestly record what is done when examining phones under public sector contracts for the Police. What they are equally saying is that they are never asked for those notes and the Police do not require them to provide those notes upfront with their evidence. It is acknowledged that much of the programming that goes on with mobile phone examination perhaps does not get recorded in the Reports that actually get presented to the Judge, Juries and to the Defence.
.
.

So what might be the way forward. Well clearly it would be very difficult to carry on the way that it has been going. Observations about what was and is also needs to be viewed. Section 69 of the Police and Criminal Evidence Act 1984 was repealed to make it easier for the Prosecution to present its evidence. Under S69 PACE 1984 the Prosecution had to provide a Certificate and demonstrate the data had not change in the operation of the computer and in the obtaining of the evidence. Presumably the Catagories assigned to S129 CJA2003 are meant to provide some form of appropriate test?
.
.

I recently raised the idea that all mobile phone forensics tools used to acquire evidence should be Certified/Validated:
.
.

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5346
.
.

Over 1800 have viewed this important discussion; 36 have voted thus far. It is not actually that difficult to create Certified/Validated tools scheme but it is largely people having expectation that costs will soar or prevent free/low cost tools being brought to the marketplace, when dealing with the way mobile phones operate and the way people and the tools conduct examination in our 'field of distinction'.
.
.

But whatever peoples' feelings about this subject, importantly Certification/Validation would provide for the Courts an open-handed description of what the tools actually do and what actually has been done to get the evidence at first instance. Moreover, it doesn't remove the requirement for user training and having technical knowledge of the science/technology from which evidence is generated, nor reduced skillset and experience. Currently if someone goes on a handset reader training course they are told they are validated as a mobile phone examiner. That simply isn't correct. The person is approved merely because they are said to have understood they from the training, push the buttons on and connect phones to the handset reading software/hardware and the output material as to where to find data. In this regard the over-marketing, perhaps unwittingly so, has created false expectation in those users who have received the tool training and leaves them noticeably vulnerable when challenged by their peers.
.
.

There is more to come on this subject, it is just that there is not sufficient time at the present moment.

Humanitarian Aid or Pay As You Throw?

Humanitarian Aid or Pay As You Throw?

Vodafone's 150 design shape reminds me that this looks like a squared-edged version of the old rounded-edged Phillips Savvy (back when Virgin Mobile sold it in a box through their music chain stores) that use to be on the market. One distinction here though is that Vodi is selling the Vodafone-150 into developing countries India, Turkey and eight African countries including Lesotho, Kenya and Ghana at $15.00 (£10.00). The disclosed objective is a worthy and laudable aim that out there in the Africa countries communications relevant to voice calls, SMS, financial transfers and healthcare have more importance and relevance than touch screen functionality, games and posturing as to who has a weird app that they want to boast about.
.

The spec given for this product:
.

"Vodafone 150 device specification: Black candy bar device with 5-way navigation key; 1.0” monochrome graphic display 96x64 pixels; voice and SMS; GSM 900/1800; polyphonic ringtones; vibration; alarm clock; calculator; currency converter; 2 embedded games; memory for up to 100 entries in phonebook plus SMS storage; torch; battery: 500mAh (standby up to 400h, talk time up to 5h); mini USB connector."
.

A truly magnificent gesture on behalf of the international community would be to allow mobile phone credits to be used to purchase food and water, medicine, etc other than only allowing it to be solely used to make a mobile calls, whilst idly sitting by watching human life being put at risk. What could there ever be the point in watching people die of starvation and dehydration?
.

Imagine for each mobile phone user a maximum credit to purchase life sustaining essentials could be made available. Imagine that specialist supply waypoints (International Humanitarian Aid Points) were setup whereby the genuine user can get food/water, medicines etc, then the waypoints can check the applicants wanting the food/water, medicines are the genuine users of the phones. What a fantastic way that would be for finitely targetting humanitarian monetary aid to those in need.
.
Of course, it is not unrealistic to observe that there is also a calculated risk being taken here that cheap handsets can lead to their owners using them as disposal objects, as opposed to meaningful devices. Any owner migrating as a roaming-user are unlikely to be barred from making calls because the handsets are dual band RF chipset(s) (GSM MHz900/GSM MHZ1800) so should work in any GSM network.
.

Cheap handset can also make them a target for unlocking. It is not hard to imagine, cheap phones like these will not be long out of the cargo doors before they are being supplied into Europe. So this is one of the calculated risks (the other side of the coin so to speak). Such low-cost handsets (or officially "ULCH phones") are not new. We were already aware of ULCH's some years back but they have now grown in status as viable products because of the World recession. Cheap handsets are in Europe at the moment and regularly used in crime and thown away afterwards.
.
.

How might any operator stop such ULCH phones being used for making chargeable calls where such calls are being made for the purposes of the commission of a crime? Well, the first obvious point is to include a validity integrity key (VIK) to be transmitted along with the IMEI and associate the VIK to the IMEI at manufacturing production stage. Were someone to clone the IMEI of a handset it would not be associated with the VIK and therefore the network could detect this and block the handset from making calls. Equally, if the financial credits on the phone were from Humanitarian Aid, then the network operator could equally help in stopping that credit being spent on phone calls associated with crime because of the VIK conflict with cloned IMEI and/or because the phone isn't in the geographical region to which it was expected to operate (as a humanitarian aid phone). Moreover, the idea of security VIK/IMEI could be implemented in every new handset issued and maybe able to be implemented via SMS Class 1 messages to older handsets already in the marketplace. Realistically, how long would this take to be implemented? It depends, in as simpler statement that can be made, how long it takes to implement signalling in the network to the EIR and a response from the EIR.
.

I have sent this thread up to President of the United States of America, Mr Barack Obama, to the World Health Organisation, Oxfam, and to UK Government etc.

Certified/Validated Mobile Phone Tools

Certified/Validated Mobile Phone Tools

.
A Poll running over on ForensicFocus (www.forensicfocus.com) concerns mobile phone tools used for examination that have not been Certified/Validated as forensically sound for the purpose to which they have and are currently being put to use to generate evidence. The Poll questions are:

.

All Mobile Phone Forensic Tools should be Certified/Validated?
--> I strongly agree all new and existing tools should be Certified/Validated
--> I strongly agree that only new tools should be Certified/Validated
--> I agree such a scheme could be useful but not a necessity
--> I disagree as such a scheme would affect sales/profits or my job skills
--> Who cares, we've been getting away with it so far
.
.

Poll weblink:
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5346

Finger powers mobile phone battery

Finger powers mobile phone battery

.
At trewmte.blogspot I have endeavoured over the years to ensure part of the content identifies innovations in the marketplace:
.
IPhone unlocker
http://trewmte.blogspot.com/2008/11/sim-dialer-iphone-unlocke.html
Telepathic Chat via Cellphone
http://trewmte.blogspot.com/2008/03/worlds-first-cellphone-telepathic-chat.html
Membrane technology
http://trewmte.blogspot.com/2008/12/another-ultra-thin-membrane-device.html
.

I also reported (back in 2008) how researched had been conducted into using sound waves to charge mobile phone batteries: http://trewmte.blogspot.com/2008/12/sound-waves-could-power-cell-phone.html . This year, 2010, a new invention has been developed that requires twirling a mobile phone battery (with the use of one finger) 130-revolutions generating 25-minutes standby time and 2-minutes talk time. The idea for this invention comes from Designers: Song Teaho & Hyejin Lee at http://www.yankodesign.com/2010/01/04/cheers-to-finger-power/. The invention is promoted using the following photoimages.
.

.
.

.
.
This invention is unliklely to replace the battery charger (PSU) but as a 'Green' (environmental) back-up power charging alternative, the idea may find merit with the mobile phone handset manufacturers. No doubt there will be those who may criticise the invention based upon 130-revolutions generating only 2-mins of talktime. However, 260-revolutions generating 4-minutes of power need not be spent 'yakking' away on the mobile phone, but perhaps sending text messages. Or it might be useful where a user's standard battery has discharged but may need to make an emergency call (999 etc); perhaps this design may have synergy with that old adage "necessity is the mother of invention".

MNO & VMNO SIM Cards

MNO & VMNO SIM Cards

.

.
If everyone can email to me (trewmte@gmail.com) a photo image of any MNO or VMNO SIMs complete in ISO Card (ID-1 card) then it could be helpful when dealing with examinations.
.
This is thread also posted at:
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4516
.
The image below is a Lyca Mobile SIM Card but embossed on the ID-1 card are the Mobile Telephone Number (MTN) and PUK Code on the front of the card. It would appear from other SIM examiners that I have spoken to that the MTN and PUK Code are commonly found on VMNO SIM Cards. Maybe MNOs ought to think about giving the PUK up front, too, as there appears no objection to the VMNOs doing it.

MNO & VMNO SIM Cards

MNO & VMNO SIM Cards

.

.
If everyone can email to me (trewmte@gmail.com) a photo image of any MNO or VMNO SIMs complete in ISO Card (ID-1 card) then it could be helpful when dealing with examinations.
.
This is thread also posted at:
http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4516
.
The image below is a Lyca Mobile SIM Card but embossed on the ID-1 card are the Mobile Telephone Number (MTN) and PUK Code on the front of the card. It would appear from other SIM examiners that I have spoken to that the MTN and PUK Code are commonly found on VMNO SIM Cards. Maybe MNOs ought to think about giving the PUK up front, too, as there appears no objection to the VMNOs doing it.

ACPO Managers Guide

ACPO Managers Guide

.
Good Practice and Advice Guide for Managers of e-Crime Investigations
.
I telephoned and spoke with a personable Stephen Clarke today of the Police Central e-crime Unit (PCeU). PCeU is the department apparently responsible for the proper and appropriate dissemination of factual information to Managers (Clients and Stakeholders) for the Police. I contacted Stephen as I was disappointed with the inaccuracy promoted in the Guide that information about my organisation was wrong and was known to be wrong long before the Guide was published in July 2009.
.
The information which I am referring to as inaccurate is on page 87 Appendix C details of Training Courses:
.
Some examples of product based training are:
PhoneBase – Trew MTE offer a range of continuous professional development certificate and accredited courses.
.
Industry and in the mobile telephone examination sections in the Police know that to be inaccurate for 2009 and comments I had back were they were surprised that statement was made as Phonebase training had ceased for a number of years.
.
Stephen Clarke, who is the person mentioned as being responsible for the Guide being in the market place (being named as its 'Author'), actually isn't the Author in the true sense of the word. In fairness to Stephen his job is to compile the parts to formulate one package for delivery. He was unaware about the errors in the Guide apparently because others behind the scenes who have their hand in preparing the data assemble the 'researched' material compiled and send it to him.
.
It becomes even more concerning when all the information promoted about the other people and companies is accurate; clearly any manager seeing my information will have noticed that the system attributed to me is not used anymore, there is no training for it now and hasn't been for some while. Was that deliberate by those who researched the material first before passing it to ACPO HQ?
.
You see this type of inaccuracy published like this gives the impression that ACPO doesn't know what it is doing or talking about inspite of the fact Quality and Accuracy checking are two components lauded as fundamentally underpinning ACPO Guidelines. The impact of that is:
.
- Firstly, ACPO Guidelines are quoted in our criminal courts of law informing the Judges and Jurors these are the standards the Police work too. That in itself is unfair to every officer or police staff who make reference to ACPO in their defence as why they followed certain procedures when the basis to the document is inaccurate;
.
- Secondly, managers are likely to make public sector spending decisions based upon this public sector document; those managers were not given the public sector opportunity to know whether they were paying too much for training and the skillsets in the training to bring value to the money they were paying.
.
- Thirdly, managers are still none the wiser as to the highly experienced training provided by TrewMTE and therefore the ACPO Managers Guide does not educate managers to the vital information they need to know in oder to take decisions.
.

Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Victorian Texting

Victorian Texting

.
During the Christmas 2009 break I managed to visit and take the tour of Porthcurno Telegraph Museum in Cornwall (http://www.porthcurno.org.uk/). A truly amazing place, full of historical artefacts depicting the history of telegraph, morse code etc. I recommend all UK and international examiners and experts who haven't been to the Museum to visit and learn about the history of telegraphy communications, its role enabling communications around the British Empire when it covered two-thirds of the world, its links to wireless communications and developed telegraphy devices and services associated with modern mobile communications today.

.

"Victorian Texting" is a good example of one such development associated with telegraph and mobile communications. I have not been able to trace the precise origin how the label 'Victorian Texting' came about but perhaps it originated in the latter part of the 20th century following the introduction of mobile phones and short message service (SMS) text messages.

.

Victorian Texting was made possible with the use of the Wheatstone's ABC Telegraph originated in 1842 developed by the English physicist and inventor Sir Charles Wheatstone (1802-1875).
.

Image 1: Charles Wheatstone - Illustration by Mary Bellis
.

The significant difference between morse code and morse code devices (already in use at that time) and Wheatstone's ABC Telegraph is that it was noted that with the latter device that it was an example of "de-skilling". Unlike Morse telegraphs, no knowledge of a code was needed. The button next to the desired letter was held down and the handle cranked. The needles of the instruments at both ends moved until they pointed to the chosen letter. The foreground part of the instrument is the transmitter, and the part at the back is the receiver (commentary from BT Museum Memorial Pages - Telegraphy 1).

.

Image 2: Wheatstone's ABC Telegraph

.

In action the operator of the ABC Telegraph could only communicate for a short distance due to the electricity needed to transmitter to the distant receiver. a cartoon depicting the use of the ABC Telegraph can be seen below (created by the engineer and cartoonist Tim Hunkin - www.timhunking.com)

.

Image 3: Hunkin's cartoon depicting the use of Wheatstone's ABC Telegraph

.
The Porthcurno Telegraph Museum website has a useful webpage that allows visitors to their website to simulate sending a text message on the Wheatstone's ABC Telegraph, so do give it a try (http://www.porthcurno.org.uk/html/object4.html).
.

Image 4: Porthcurno Telegraph Museum interactive webpage - Wheatstone's ABC Telegraph

.
Telegraph - Morse Code

The above is, of course, not the first time developments associated telegraph has been linked with mobile communications texting. For instance, the "Special" tone available to users of Nokia phones when receiving SMS (text messages) is actually Morse code for "SMS". Similarly, the "Ascending" SMS tone is Morse code for "Connecting People," Nokia's slogan. The "Standard" SMS tone is Morse code for "M" (Message).

http://www.newlaunches.com/archives/10_things_you_did_not_know_about_nokia.php

.
Reference Sources:

http://www.porthcurno.org.uk/
http://www.porthcurno.org.uk/html/object4.html
http://inventors.about.com/od/wstartinventions/a/Wheatstone.htm

http://www.samhallas.co.uk/bt_museum/telegraph.htm
http://www.newlaunches.com/archives/10_things_you_did_not_know_about_nokia.php

http://en.wikipedia.org/wiki/Nokia

http://www.timhunkin.com/a114_more-exhibits.htm

Evidence - Spooks BBC1 - Did you watch?

Evidence - Spooks BBC1 - Did you watch?

.

Did any of you watch Spooks tonight (BBC1, 9pm)?

.

The Muslim character said that his fanatic friends were logged under "Football".

.

The Spook took out the SIM Card from the phone and copied it using a SIM reader memory device.

.

Questions:

.

1) Would it be obvious that names/numbers and groups are only recorded on SIM Card?

.

2) What about the mobile phone used by the character playing the Muslim; would the mobile phone store relevant names/numbers under groups?

.

3) Does that mean that nothing is recorded under "groups" in the handset phonebook?

.

The programme sets a challenging puzzle for mobile telephone examiners.

.

What if the character was a European? Would that really make any difference?

.

How good are you as a mobile telephone examiner, really?

UK MTEB Mobile Forensics Conference 2010

UK MTEB Mobile Forensics

.

Conference - September 2010

.

Conference Centre - TBA

.

Practitioners - Exhibition - Business

.

.

Britain is a World leader in GSM and 3G mobile telephones, forensics, examination and evidence; GB remains the international centre for commerce, business and manufacturing, designers, software & programming and technology services. Forensics should be Stock Exchange commodity for the future.

.

On the strength of Britain's position we hosted the first UK MTEB Mobile Forensics Conference on the 25th and 26th November 2009 and following the success of that conference there is to be a second Conference in September 2010.

.

Grow your mobile and telecommunication business, manufacturing and forensic services in GB plc.

First case using wireless communications - history

First case using wireless communications - history

.

Photo courtesy of executedtoday.com

.

At the first UK MTEB Mobile Forensics Conference 2009, last week (25th/26th Nov), the speaker Adam Gersch (Barrister 23 Essex Street) provided the audience with a refreshing reminder of the first case in the UK that made use of wireless telegraphy communication evidence in criminal proceedings noted in the landmark case of Dr (Hawley Harvey) Crippen. Dr Crippen was caught whilst escaping onboard a ship crossing the Atlantic Ocean by the eagle-eyed Ship's Captain who suspected two passengers travelling under the name of 'John Robinson' to be Crippen and his girlfriend (dressed as a boy) as the ‘cellar-murder fugitive and his friend’ wanted by the Police and on the run.

.

In the nick of time the Ship's Captain sent a wireless telegram to the authorities before the ship would be out of radio range for ship-to-shore wireless communications to let them know of their presence on board his ship. Dr Crippen was found guilty at trial and was executed at Pentonville Prison on the 23rd November 1910.

.

Links to background of Dr Crippen Case:

http://www.executedtoday.com/2007/11/23/1910-hawley-harvey-crippen/
http://www.discoverychannel.co.uk/web/crime-museum-uk/episode-guide/dr-crippen/

.

As an analogy, perhaps a wireless telegram back then would most probably equate today as a wireless telegraphy SMS text message (in terms of mobile telephones). This case is a useful reminder of the importance radio provided back then and still today mobile communications new and exciting evolution continues to provide important communication services, infrastructure and networks, nationally and internationally.

.

Mobile Communications Science History:

Of course, the mobile telephone's use of wireless telegraphy has its roots in scientific history long before the hybrid computer was even dreamt about:

.

- 1868: James Clerk Maxwell postulates EM wave phenomenon ethereal wind theory

- 1886: Heinrich Rudolf Hertz establishes proof of EM wave (Hertz cycle)

- 1893:Gugliemo Marconi first use of wireless and first patent of wireless communications

- 1905: Reginald Fessenden first transmission of speech and music via a wireless link

- 1908: Nathan B. Stubblefield invented and patented the first mobile telephone over 100-years ago

- etc

.

http://trewmte.blogspot.com/2009/01/mobile-forensics-and-evidence-degrees.html

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3388

TimeTable - UK MTEB Mobile Forensics Conference 2009

Conference Timetable

.
25/11/09
.
REGISTRATION: 8.45am
.
Conference Opens: 9.15am
.
Speaker 1: 9.30am - 10.00am
Greg Smith TrewMTE
Looking at the way forward
.
Speaker 2: 10.00am - 10.50am
Peter Jones Zentek Forensics
Issues and Difficulties of a Mobile Phone Practitioner
.
Tea/Coffee 10.50am - 11.00am
.
Speaker 3: 11.00am - 11.50am
Adam Gersch Barrister 23 Essex Street
s129 CJA2003 and Obtaining Evidence
.
Speaker 4: 12.00 - 12.50pm
Barrister
.
Lunch 1.00pm -2.00pm
.
Speaker 5: 2.00pm - 2.50pm
Mike Dickinson XRY MicroSystemation
(ex-Detective Inspector Hampshire)
Issues when dealing with Seizure Procedure
.
Speaker 6: 3.00pm - 3.50pm
Greg Smith TrewMTE
Mobiles as Dangerous Weapons
.
Tea/Coffee 4.00pm - 4.50am
.
Speaker 7: 5.00pm - 5.30pm
Peter Jones Zentek Forensics
Summary points for the first day's events
.
26/11/09
.
Conference Opens: 8.45am
.
Speaker 8: 9.00am - 9.50am
Vinny Parmar Digital Evidence Examiner
Mobile Telephone Examination Best Practice Model
.
Speaker 9: 10.00am - 10.50am
Jan Collie DigitalDetective
How to Investigate Evidence
.
Tea/Coffee 10.50am - 11.00am
.
Speaker 11: 11.00am - 11.50am
Samantha Raincock SRC
Call Records and Mobile Data Correlations
.
Speaker 12: 12.00 - 12.50pm
Roger Wilkins FMS
Cell Site Analysis Methodology
.
Lunch 1.00pm - 2.00pm
.
Speaker 13: 2.00pm - 2.50pm
Terry Wise Independent Expert
RIPA, CPIA, DPA etc
.
Speaker 14: 3.00pm - 3.50pm
David Sullivan Specialist Recuitment
Mobile Forensics Recruitment
.
Tea/Coffee 4.00pm - 4.50am
.
Speaker 15: 5.00pm - 5.30pm
Greg Smith TrewMTE/ Peter Jones Zentek Forensics
Summary points for the second day's events
.
26/11/09
.
Break Out Training Sessions (BOTS)
.
Morning Sessions
.
BOTS1 - 11.00am to 12.50pm
Mike Dickinson
Mobile Handset Device Examination and Hex Dumping
.
BOTS2 - 11.00am to 12.50pm
Amir Bashir Digital Evidence Examiner
Mobile Telephone Examination Techniques
.
Afternoon Sessions
.
BOTS3 - 2.00pm to 3.50pm
Sean Desmond Anite Nemo Handy
Radio Testing and Cell Site Analysis
.
BOTS4 - 2.00pm to 3.50pm
Samantha Raincock SRC
Call Records and Mobile Data Correlations